Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco A few words on implementation Architecture“layered”
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco A few words on implementation Implementation choices Database MongoDB Scalable Non relational, a good way to prototype A database per trace Avoid inter-trace lock Allow hypothesis on entries
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco A few words on implementation Implementation choices Database MongoDB Scalable Non relational, a good way to prototype A database per trace Avoid inter-trace lock Allow hypothesis on entries Getting an execution trace Intel PIN Miasm sandbox IDA, ollydbg, . . .
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco A few words on implementation Implementation choices Database MongoDB Scalable Non relational, a good way to prototype A database per trace Avoid inter-trace lock Allow hypothesis on entries Getting an execution trace Intel PIN Miasm sandbox IDA, ollydbg, . . . Disassembly engine DiStorm Then Miasm, to be architecture independant . . . and have an IR
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco A few words on implementation Memory model Detailed information available in [SSTIC 2014 - Actes]
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Miasm in 2 slides Agenda First layer: Code flattening 1 pTra 2 What is this ? A few words on implementation Miasm in 2 slides Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Miasm in 2 slides Miasm in 2 slides - 1 Context Developed by F. Desclaux Miasm v2 released in June 2014 Available on http://code.google.com/p/miasm
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Miasm in 2 slides Miasm in 2 slides - 1 Context Developed by F. Desclaux Miasm v2 released in June 2014 Available on http://code.google.com/p/miasm Lego bricks Python 1 Assembly / Disassembly engine“easy-to-write” 2 Intermediate representation RE oriented (8 words) 3 JIT engine (TinyCC, LLVM, Python based) 4 Regression tests :) 5
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Miasm in 2 slides Miasm in 2 slides - 2 Features Supported architectures x86 { 16, 32, 64 } bits ARMv7 / Thumb MSP430 SH4 MIPS32 Customizable simplification engine PE / ELF / shellcode sandboxing Common MSDN APIs simulation (or how to rewrite Windows architecture independant) ELF / PE binary manipulation thanks to Elfesteem Links with STP solver, debuggers, IDA viewer
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Miasm in 2 slides Miasm in 2 slides - Demonstration Demo: Shellcode sandboxing (Try & die approach)
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Miasm in 2 slides Miasm in 2 slides - Demonstration Demo: ARMv7 execution trace - MD5
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Introduction Constants detection Dataflow obfuscation Data slicing and functions rebuilding Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Introduction Constants detection Dataflow obfuscation Data slicing and functions rebuilding Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Algorithm reconstruction - Introduction What we want to know Fully understand an algorithm What’s inside (encryption, derivations, . . . ) ⇒ pTra database contains all we need
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Algorithm reconstruction - Introduction What we want to know Fully understand an algorithm What’s inside (encryption, derivations, . . . ) ⇒ pTra database contains all we need How to proceed Identify all parts (functions, crypto) 1 Find inputs and outputs of each part 2 Understand links between them 3
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Constants detection Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Introduction Constants detection Dataflow obfuscation Data slicing and functions rebuilding Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Constants detection Constants detection - Theory What we know A cryptographic algorithm can be composed of some“magic” constants Hash functions are a good example If an algorithm is present, we must find its constants
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Constants detection Constants detection - Theory What we know A cryptographic algorithm can be composed of some“magic” constants Hash functions are a good example If an algorithm is present, we must find its constants Where can we find them? Interesting places: Instructions (static analysis) Processor’s registers Memory accesses ⇒ pTra provides a direct access to these elements
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Constants detection Constants detection - Practical Method Add a module to pTra Full research in database for known constants Avoid false positives Low probability We can group results to detect isolated constants Simple, quick and efficient
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Constants detection Constants detection - Practical Method Add a module to pTra Full research in database for known constants Avoid false positives Low probability We can group results to detect isolated constants Simple, quick and efficient Results Mersenne Twister identification ( 0x6c078965 ) SHA-1 identification ( 0x67452301 , 0xefcdab89 , 0x98badcfe , 0x10325476 , 0xc3d2e1f0 ) ⇒ Adding SHA-1 primitives knowledge into our call graph ( init , update , final )
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Introduction Constants detection Dataflow obfuscation Data slicing and functions rebuilding Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation I/O identification - Theory Purposes Unidentified functions: Understanding I/Os can help us to identify them Already identified functions: Find where arguments come from Establish the link with other algorithms ⇒ We must find functions input and output
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation I/O identification - Theory Purposes Unidentified functions: Understanding I/Os can help us to identify them Already identified functions: Find where arguments come from Establish the link with other algorithms ⇒ We must find functions input and output What we know By studying memory accesses of a function: If a data is processed, it will be read Results (outputs) will be written ⇒ pTra can help us to find them
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation I/O identification - Practical Methods To identify outputs: Memory diff (state after) - (state before) We can remove data written and read before the end (temporary data) To identify inputs: Data read for the first time by the function We can add several heuristics (pointers detection, blocks grouping, entropy computing, . . . )
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation I/O identification - Results Facts Very efficient method to link algorithms parts between them We found another protection by looking for I/Os: transformed memory Data in memory never appear in clear format No pattern identified in the code There is a derivation function per memory area
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation I/O identification - Results Facts Very efficient method to link algorithms parts between them We found another protection by looking for I/Os: transformed memory Data in memory never appear in clear format No pattern identified in the code There is a derivation function per memory area Identified algorithms Identified SHA-1 inputs/output verified SHA-1 inputs : Certificates ⇒ Cert-chain validation RSA-SHA1 signature algorithm is used ⇒ We have to identify RSA function
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation I/O identification - RSA identification Main idea Destroy modular exponentiation effect of RSA Compare execution traces
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dataflow obfuscation I/O identification - RSA identification Main idea Destroy modular exponentiation effect of RSA Compare execution traces Steps We know RSA algorithm is used (at least) in cert-chain validation 1 Patch all certificates pub exponents to 1 2 Patch all certificates pub modulus to max value (0xFF..FF) 3 Produce a new execution trace 4 Locate some functions differences (in number of instructions) 5 RSA located ( ± 50 million instructions) 6 ⇒ Add RSA knowledge to the call-graph 7
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Data slicing and functions rebuilding Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Introduction Constants detection Dataflow obfuscation Data slicing and functions rebuilding Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Data slicing and functions rebuilding Data slicing and functions rebuilding Definitions Data tainting : find all elements that depend on a given one Data slicing : find all elements influencing a given one Data tainting is forward, and slicing is backward
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Data slicing and functions rebuilding Data slicing and functions rebuilding Definitions Data tainting : find all elements that depend on a given one Data slicing : find all elements influencing a given one Data tainting is forward, and slicing is backward Data slicing implementation Using Miasm IR: Symbolic execution of basic block containing target element 1 We get dependencies of its equation 2 Search for latest writes of each ones 3 And so on. 4 For data tainting, we proceed almost the same way. We just target elements whose contain the target in their dependencies.
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Data slicing and functions rebuilding Dependencies graph Demo: pTra - Slicing as a commercial (with colors)
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Data slicing and functions rebuilding RSA-OAEP R2, R4, R5 : Random values
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Some clues Dynamic AES-CBC WhiteBox identification Results Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Some clues Dynamic AES-CBC WhiteBox identification Results Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Dependencies graph
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Equivalence class Equivalence class statement Data d1 and d2 are equivalent if and only if their first reads are done by the same instruction. Two instructions are said the same if and only if they share the same address.
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Equivalence class Equivalence class statement Data d1 and d2 are equivalent if and only if their first reads are done by the same instruction. Two instructions are said the same if and only if they share the same address. Example Class: 01 02 03 04 01 02 03 04 01 02 03 04 05 Data: 63 66 F5 F3 76 DC B1 C1 F6 BC 4D 21 7E
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Equivalence class Equivalence class statement Data d1 and d2 are equivalent if and only if their first reads are done by the same instruction. Two instructions are said the same if and only if they share the same address. Example Class: 01 02 03 04 01 02 03 04 01 02 03 04 05 Data: 63 66 F5 F3 76 DC B1 C1 F6 BC 4D 21 7E Grouping 63 66 F5 F3 76 DC B1 C1 F6 BC 4D 21 7E
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Equivalence class Applied to dataset 1 16 bytes +-------------------+ | Block 1 | +-------------------+ | Block 2 | +-------------------+ | | | Block 3: | | Group of 16 | | bytes block | | | +-------------------+
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Equivalence class Applied to dataset Applied to output block (reversed way, last write) 1 16 bytes +-------------------+ 1 2 16 bytes | Block 1 | +--+ +-------------------+ | | /* 2 bytes blocks */ | Block 2 | +--+ +-------------------+ +----------------+ | | __| | | Block 3: | | | | Group of 16 | | Bytes group | | bytes block | | | | | | | +-------------------+ | ________| | | +----------+ +--------+ /* Bytes | | on the +--------+ output, but never read */
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Function rebuilding 1 def make_C3(inp): 2 3 C3 = [inp] 4 for i in xrange (10): 5 tmp = [] 6 tmp.append(inp [0] ^ table1 [(0 x100*i)+inp [13]]) 7 tmp.append(inp [1] ^ table2[inp [14]]) 8 tmp.append(inp [2] ^ table2[inp [15]]) 9 tmp.append(inp [3] ^ table2[inp [12]]) 10 tmp.append(inp [4] ^ tmp [0]) 11 tmp.append(inp [5] ^ tmp [1]) 12 tmp.append(inp [6] ^ tmp [2]) 13 tmp.append(inp [7] ^ tmp [3]) 14 tmp.append(inp [8] ^ tmp [4]) 15 tmp.append(inp [9] ^ tmp [5]) 16 tmp.append(inp [10] ^ tmp [6]) 17 tmp.append(inp [11] ^ tmp [7]) 18 tmp.append(inp [12] ^ tmp [8]) 19 tmp.append(inp [13] ^ tmp [9]) 20 tmp.append(inp [14] ^ tmp [10]) 21 tmp.append(inp [15] ^ tmp [11]) 22 C3.append(tmp) 23 inp = tmp 24 25 return C3
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Some clues Comparison between make_c3 and AES key scheduling
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dynamic AES-CBC WhiteBox identification Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Some clues Dynamic AES-CBC WhiteBox identification Results Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dynamic AES-CBC WhiteBox identification Dynamic AES-CBC WhiteBox identification Identification Try to reproduce intputs/outputs ⇒ Results don’t match ⇒ Encryption steps are completely done on modified states, key in input list ⇒ “ Dynamic ”whitebox
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Dynamic AES-CBC WhiteBox identification Dynamic AES-CBC WhiteBox identification Identification Try to reproduce intputs/outputs ⇒ Results don’t match ⇒ Encryption steps are completely done on modified states, key in input list ⇒ “ Dynamic ”whitebox Interest in a DRM Wasting analysts time Hiding inputs and outputs Difficulty to reproduce the algorithm on another system (apart ripping it) Reverse algorithm is hard to find
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Results Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Some clues Dynamic AES-CBC WhiteBox identification Results Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Results Results Attack Homomorphic algorithm (to XOR) 1 Mathematic properties needed 2 A limited set of candidates 3 ⇒ Derivation functions computation We are finally able to read/alter values encrypted by the algorithm, which is a 128 bits AES-CBC.
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Introduction Industrial version Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Introduction Industrial version Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Instruction substitution - Basics Trivial method For x ∈ [0 , 2 32 − 1] : f ( x ) = (16 ∗ x + 16) mod 2 32 could be rewritten as: f ( x ) = 129441535 − 1793574399 ∗ (1584987567 ∗ (3781768432 ∗ x + 2881946191) − 4282621936)
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Instruction substitution - Basics Trivial method For x ∈ [0 , 2 32 − 1] : f ( x ) = (16 ∗ x + 16) mod 2 32 could be rewritten as: f ( x ) = 129441535 − 1793574399 ∗ (1584987567 ∗ (3781768432 ∗ x + 2881946191) − 4282621936) Simplification Function simplified by modern compilation passes (particularly constant folding)
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Instruction substitution - Advanced MBA : Mixed Boolean Arithmetic By mixing logical and arithmetical transformations: ( x + y ) ≡ (( x ∧ y ) + ( x ∨ y )) ( x + y ) ≡ (( x ⊕ y ) + 2 × ( x ∧ y )) ( x ⊕ y ) − y ≡ ( x ∧ ¬ y ) − ( x ∧ y )
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Instruction substitution - Advanced MBA : Mixed Boolean Arithmetic By mixing logical and arithmetical transformations: ( x + y ) ≡ (( x ∧ y ) + ( x ∨ y )) ( x + y ) ≡ (( x ⊕ y ) + 2 × ( x ∧ y )) ( x ⊕ y ) − y ≡ ( x ∧ ¬ y ) − ( x ∧ y ) Simplification Nothing from compiler passes Nothing more from MatLab, Maple, Mathematica or Z3
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction Instruction substitution - Advanced MBA : Mixed Boolean Arithmetic By mixing logical and arithmetical transformations: ( x + y ) ≡ (( x ∧ y ) + ( x ∨ y )) ( x + y ) ≡ (( x ⊕ y ) + 2 × ( x ∧ y )) ( x ⊕ y ) − y ≡ ( x ∧ ¬ y ) − ( x ∧ y ) Simplification Nothing from compiler passes Nothing more from MatLab, Maple, Mathematica or Z3 Effective simplification Once equations are identified, capitalize them thanks to Miasm simplification engine By using the generation algorithm of these expressions
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction MBA generation Construction A matrix A in { x , y , x ⊕ y , . . . } base (expressions are represented by their truth table) An associated vector v composed of { 1, -1 } standing for operation between elements Equation is valid / generalizable to 2 n iff a linear combination of A ’s columns is equal to null element
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction MBA generation Construction A matrix A in { x , y , x ⊕ y , . . . } base (expressions are represented by their truth table) An associated vector v composed of { 1, -1 } standing for operation between elements Equation is valid / generalizable to 2 n iff a linear combination of A ’s columns is equal to null element Example x + y − ( x ⊕ y ) � A = ( f 1 , f 2 , f 3 ) (1) v = (+1 , +1 , − 1) f 1 = x = (0 , 0 , 1 , 1) f 2 = y = (0 , 1 , 0 , 1) (2) f 3 = x ⊕ y = (0 , 1 , 1 , 0)
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction MBA simplification Example x + ¬ x − ( x ∧ y ) − ( x ⊕ y ) + ¬ y
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction MBA simplification Example x + ¬ x − ( x ∧ y ) − ( x ⊕ y ) + ¬ y 0 1 0 0 1 0 1 0 1 0 = A 1 0 0 1 1 1 0 1 0 0 = (+1, +1, -1, -1, +1) v
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction MBA simplification Example x + ¬ x − ( x ∧ y ) − ( x ⊕ y ) + ¬ y 0 1 0 0 1 0 1 0 1 0 = A 1 0 0 1 1 1 0 1 0 0 = (+1, +1, -1, -1, +1) v Linear combination +2 +0 +1 +0
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction MBA simplification Smallest addition to nullify 1 1 0 0 A = 1 0 0 0 v = (-1, -1) Final equation x + ¬ x − ( x ∧ y ) − ( x ⊕ y ) + ¬ y − ¬ y − ¬ ( x ∨ y ) = 0
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Introduction MBA simplification Smallest addition to nullify 1 1 0 0 A = 1 0 0 0 v = (-1, -1) Final equation x + ¬ x − ( x ∧ y ) − ( x ⊕ y ) + ¬ y − ¬ y − ¬ ( x ∨ y ) = 0 x + ¬ x − ( x ∧ y ) − ( x ⊕ y ) + ¬ y = ¬ y + ¬ ( x ∨ y )
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Industrial version Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Introduction Industrial version Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Industrial version Transfer equation of the targeted function
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Industrial version Variable identification, then function resolution: XOR 0x5C
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Agenda First layer: Code flattening 1 pTra 2 Algorithm reconstruction : RSA-OAEP 3 Rebuilding a cipher function“whiteboxed” : AES-CBC 4 Ecofriendly step: Instruction substitution 5 Bonus 6
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Graphing memory accesses over the time
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Zoom on stack, loop detection
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco O-LLVM Why O-LLVM? Open-source Recent project Implemented protections Instruction substitution Opaque predicates ( Bogus control flow ) Code flattening
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Initial function: addition
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco After code flattening
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco CFG rebuilding (using symbolic execution)
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco So . . .
Introduction First layer: Code flattening pTra Algorithm reconstruction : RSA-OAEP Rebuilding a cipher function “whiteboxed” : AES-CBC Eco Conclusion Approach interests Allowed us to analyse state of the art obfuscation mechanisms One more method in analyst’s toolbox Can be used in other cases such as malware analysis, vulnerability research, . . .
Recommend
More recommend
